Here's a rough break down, formatted best I can for HN:
reply Safari (closed source)
├─ UI / tabs / preferences
├─ macOS / iOS integration
└─ WebKit framework (open source) ~60%
├─ WebCore (HTML/CSS/DOM)
├─ JavaScriptCore (JS engine)
└─ Web InspectorThere's much more to a browser than JS engine.
replyThey picked to most open-source one.
WebKit is not open source?
replySure there are closed source parts of Safari, but I'd guess at least 90% of safari attack surface is in WebKit and it's parts.
In many cases, the difference between a bug and an attack vector lies in the closed source areas.
replyThis is going to be the case automating attack detection against most programs where a portion is obscured.
>In many cases, the difference between a bug and an attack vector lies in the closed source areas.
replyYou say many cases, let's see some examples in Safari.
However, Firefox also needs to use the closed source OS when running on Windows or macOS.
replyThere are also WebKit-based Linux browsers, which obviously do not use closed-source OS interfaces.
My pessimistic guess on reasoning is that they suspected Firefox to have more tech debt.
Apple is not the kind of company that typically does these things, even if the entire Safari is open source.
reply